Attackers Target Unpatched Roundcube Servers With CVE-2026-48842

Attackers are exploiting CVE-2026-48842 against unpatched Roundcube servers months after a fix was released, raising urgency for organizations to update.
The Hacker News

Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild

The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before ...

Hackers now exploit critical Roundcube flaw in code injection attacks

A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.

Update now! Attacks on Roundcube webmail instances observed

Attackers are currently exploiting a security vulnerability in Roundcube webmail. However, the prerequisites must be met.
Help Net Security

Roundcube XSS flaw exploited to steal credentials, email (CVE-2024-37383)

Attackers have exploited an XSS vulnerability (CVE-2024-37383) in the Roundcube Webmail client to target a governmental organization of a CIS country, Positive Technologies (PT) analysts have ...